# CWE-204. Every Advisory and CVE whose sources give the weakness CWE-204, newest first. ## Records, newest first (an older page) - [User Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims Management](https://agentprime.io/advisories/CVE-2025-42903.md) `CVE-2025-42903` · CVE record: SAP_SE SAP Financial Service Claims Management · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-204 - [User Enumeration by excessive error output](https://agentprime.io/advisories/CVE-2025-58586.md) `CVE-2025-58586` · CVE record: SICK AG Baggage Analytics and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2025 · Tags: CWE-204 - [Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username exists or not by returning different error messages ("Unknown user" vs.](https://agentprime.io/advisories/CVE-2025-56764.md) `CVE-2025-56764` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: CWE-204 - [Saleor has user enumeration vulnerability due to different error messages](https://agentprime.io/advisories/CVE-2025-58442.md) `CVE-2025-58442` · CVE record: saleor saleor · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-204 - [Mautic Vulnerable to User Enumeration via Response Timing](https://agentprime.io/advisories/GHSA-3ggv-qwcp-j6xg.md) `GHSA-3ggv-qwcp-j6xg`, `CVE-2025-9824`, `PKSA-f1xn-2dhr-qrdb` · Packagist `mautic/core`: affected `>=4.4.0, <4.4.17 || >=5.0.0-alpha, <5.2.8 || >=6.0.0-alpha, <6.0.5`, fixed in `4.4.17`, `5.2.8`, `6.0.5` · CVSS 5.9 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: CWE-204 - [Silverpeas Core Username Enumeration Vulnerability](https://agentprime.io/advisories/GHSA-cv2m-5pfp-f245.md) `GHSA-cv2m-5pfp-f245`, `CVE-2025-46047` · Maven `org.silverpeas.core:silverpeas-core`: affected `>=6.4.1, <6.4.3`, fixed in `6.4.3` · CVSS 6.5 Medium · Not analysed yet · Published 2 Sept 2025 · Tags: CWE-20, CWE-204 - [Portabilis i-Diario Password Recovery Endpoint email observable response discrepancy](https://agentprime.io/advisories/CVE-2025-9109.md) `CVE-2025-9109` · CVE record: Portabilis i-Diario · CVSS 6.3 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: Information disclosure, CWE-204 - [CWE-204: Observable Response Discrepancy](https://agentprime.io/advisories/CVE-2025-46390.md) `CVE-2025-46390` · CVE record: Emby MediaBrowser · CVSS 7.5 High · Not analysed yet · Published 6 Aug 2025 · Tags: CWE-204 - [OPEXUS FOIAXpress Public Access Link (PAL) unauthenticated username enumeration](https://agentprime.io/advisories/CVE-2025-54834.md) `CVE-2025-54834` · CVE record: OPEXUS FOIAXpress Public Access Link (PAL) · CVSS 6.9 Medium · Not analysed yet · Published 31 Jul 2025 · Tags: CWE-204 - [Tuleap vulnerable to user enumeration via the lost password form](https://agentprime.io/advisories/CVE-2025-52899.md) `CVE-2025-52899` · CVE record: Enalean tuleap · CVSS 5.3 Medium · Not analysed yet · Published 29 Jul 2025 · Tags: CWE-204 - [HAXiam allows for User Enumeration](https://agentprime.io/advisories/CVE-2025-54129.md) `CVE-2025-54129` · CVE record: haxtheweb issues · CVSS 4.3 Medium · Not analysed yet · Published 21 Jul 2025 · Tags: CWE-204 - [CVE-2025-27451](https://agentprime.io/advisories/CVE-2025-27451.md) `CVE-2025-27451` · CVE record: Endress+Hauser Endress+Hauser MEAC300-FNADE4 · CVSS 5.3 Medium · Not analysed yet · Published 3 Jul 2025 · Tags: CWE-204 - [MB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24](https://agentprime.io/advisories/CVE-2025-3092.md) `CVE-2025-3092` · CVE record: Helmholz myREX24 and 3 more · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2025 · Tags: CWE-204 - [SinoTrack GPS Receiver Weak Authentication](https://agentprime.io/advisories/CVE-2025-5485.md) `CVE-2025-5485` · CVE record: SinoTrack IOT PC Platform · CVSS 8.8 High · Not analysed yet · Published 12 Jun 2025 · Tags: CWE-204 - [User enumeration](https://agentprime.io/advisories/CVE-2025-49187.md) `CVE-2025-49187` · CVE record: SICK AG SICK Field Analytics · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2025 · Tags: CWE-204 - [IBM Security Verify Access information disclosure](https://agentprime.io/advisories/CVE-2025-0163.md) `CVE-2025-0163` · CVE record: IBM Security Verify Access and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 11 Jun 2025 · Tags: CWE-204 - [Mautic allows user name enumeration due to response time difference on password reset form](https://agentprime.io/advisories/GHSA-424x-cxvh-wq9p.md) `GHSA-424x-cxvh-wq9p`, `CVE-2024-47057`, `PKSA-s7ys-knkq-xqw6` · Packagist `mautic/core`: affected `>=1.0.0, <4.4.16 || >=5.0.0-alpha, <5.2.6 || >=6.0.0-alpha, <6.0.2`, fixed in `4.4.16`, `5.2.6`, `6.0.2` · CVSS 5.3 Medium · Not analysed yet · Published 28 May 2025 · Tags: Information disclosure, CWE-204 - [Observable Response Discrepancy](https://agentprime.io/advisories/CVE-2025-3939.md) `CVE-2025-3939` · CVE record: Tridium Niagara Framework and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 22 May 2025 · Tags: CWE-204 - [Observable Response Discrepancy](https://agentprime.io/advisories/CVE-2025-48015.md) `CVE-2025-48015` · CVE record: Schweitzer Engineering Laboratories SEL-5056 Software-Defined Network Flow Controller · CVSS 3.7 Low · Not analysed yet · Published 20 May 2025 · Tags: CWE-204 - [Siemens Polarion V2310: A vulnerability has been identified in Polarion V2310 (All versions)…](https://agentprime.io/advisories/CVE-2024-51447.md) `CVE-2024-51447` · CVE record: Siemens Polarion V2310 and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 13 May 2025 · Tags: CWE-204 - [Umbraco Makes User Enumeration Feasible Based on Timing of Login Response](https://agentprime.io/advisories/GHSA-4g8m-5mj5-c8xg.md) `GHSA-4g8m-5mj5-c8xg`, `CVE-2025-46736` · NuGet `Umbraco.Cms`: affected `<10.8.10 || >=11.0.0-rc1, <13.8.1`, fixed in `10.8.10`, `13.8.1` · CVSS 5.3 Medium · Not analysed yet · Published 6 May 2025 · Tags: CWE-204 - [A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernames via multiple crafted HTTP requests.](https://agentprime.io/advisories/CVE-2025-24342.md) `CVE-2025-24342` · CVE record: Bosch Rexroth AG ctrlX OS - Device Admin · CVSS 5.3 Medium · Not analysed yet · Published 30 Apr 2025 · Tags: CWE-204 - [Silverstripe Framework user enumeration via timing attack on login and password reset forms](https://agentprime.io/advisories/GHSA-256q-hx8w-xcqx.md) `GHSA-256q-hx8w-xcqx`, `PKSA-7qg6-pyzm-bc35` · Packagist `silverstripe/framework`: affected `>=4.0.0, <5.3.23`, fixed in `5.3.23` · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2025 · Tags: CWE-204 - [Shopware 6 allows attackers to check for registered accounts through the store-api](https://agentprime.io/advisories/GHSA-hh7j-6x3q-f52h.md) `GHSA-hh7j-6x3q-f52h`, `CVE-2025-30150`, `PKSA-4xth-xj4w-m8t1`, `PKSA-dbxn-psgm-2qmr` · Packagist `shopware/core` and 1 more: affected `<6.5.8.18 || >=6.6.0.0, <6.6.10.3 || >=6.7.0.0-rc1, <6.7.0.0-rc2`, fixed in `6.5.8.18`, `6.6.10.3`, `6.7.0.0-rc2` · CVSS 5.5 Medium · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-204 - [Siemens Mendix Runtime V10: A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0)…](https://agentprime.io/advisories/CVE-2025-30280.md) `CVE-2025-30280` · CVE record: Siemens Mendix Runtime V10 and 4 more · CVSS 6.9 Medium · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-204 - [IBM TXSeries for Multiplatforms information disclosure](https://agentprime.io/advisories/CVE-2024-56476.md) `CVE-2024-56476` · CVE record: IBM TXSeries for Multiplatforms · CVSS 5.3 Medium · Not analysed yet · Published 2 Apr 2025 · Tags: CWE-204 - [Zitadel allows User Enumeration by loginname attribute normalization](https://agentprime.io/advisories/CVE-2025-31124.md) `CVE-2025-31124` · CVE record: zitadel zitadel · CVSS 5.3 Medium · Not analysed yet · Published 31 Mar 2025 · Tags: Information disclosure, CWE-204 - [User enumeration vulnerability in MeetMe products](https://agentprime.io/advisories/CVE-2025-2910.md) `CVE-2025-2910` · CVE record: Fermax MeetMe · CVSS 6.9 Medium · Not analysed yet · Published 28 Mar 2025 · Tags: CWE-204 - [User Enumeration via Discrepancies in Error Messages in the Celk Sistemas Celk Saude v.3.1.252.1 password recovery functionality which allows a remote attacker to enumerate users through discrepancie…](https://agentprime.io/advisories/CVE-2024-55198.md) `CVE-2024-55198` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 13 Mar 2025 · Tags: CWE-204 - [Flask-AppBuilder Observable Response Discrepancy](https://agentprime.io/advisories/GHSA-p8q5-cvwx-wvwp.md) `GHSA-p8q5-cvwx-wvwp`, `CVE-2025-24023`, `PYSEC-2025-15` · PyPI `flask-appbuilder`: affected `<4.5.3`, fixed in `4.5.3` · CVSS 3.7 Low · Not analysed yet · Published 3 Mar 2025 · Tags: CWE-204 - [Q-Free MaxTime: A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than…](https://agentprime.io/advisories/CVE-2025-1101.md) `CVE-2025-1101` · CVE record: Q-Free MaxTime · CVSS 5.3 Medium · Not analysed yet · Published 12 Feb 2025 · Tags: CWE-204 - [Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP](https://agentprime.io/advisories/CVE-2025-23193.md) `CVE-2025-23193` · CVE record: SAP_SE SAP NetWeaver Server ABAP · CVSS 5.3 Medium · Not analysed yet · Published 11 Feb 2025 · Tags: CWE-204 - [Pimcore Admin Classic Bundle allows user enumeration](https://agentprime.io/advisories/GHSA-vr5f-php7-rg24.md) `GHSA-vr5f-php7-rg24`, `CVE-2025-24980`, `PKSA-zrrf-rscm-s1xv` · Packagist `pimcore/admin-ui-classic-bundle`: affected `<1.7.4`, fixed in `1.7.4` · CVSS 6.9 Medium · Not analysed yet · Published 7 Feb 2025 · Tags: CWE-204 - [IBM Aspera Faspex information disclosure](https://agentprime.io/advisories/CVE-2023-37413.md) `CVE-2023-37413` · CVE record: IBM Aspera Faspex · CVSS 5.3 Medium · Not analysed yet · Published 29 Jan 2025 · Tags: CWE-204 - [IBM Sterling File Gateway information disclosure](https://agentprime.io/advisories/CVE-2023-47159.md) `CVE-2023-47159` · CVE record: IBM Sterling File Gateway · CVSS 4.3 Medium · Not analysed yet · Published 27 Jan 2025 · Tags: CWE-204 - [IBM Control Center information disclosure](https://agentprime.io/advisories/CVE-2024-35114.md) `CVE-2024-35114` · CVE record: IBM Control Center · CVSS 5.3 Medium · Not analysed yet · Published 25 Jan 2025 · Tags: CWE-204 - [Issue with AWS Sign-in IAM User Login Flow - Possible Username Enumeration](https://agentprime.io/advisories/CVE-2025-0693.md) `CVE-2025-0693` · CVE record: AWS AWS Sign-in IAM Login Flow · CVSS 6.9 Medium · Not analysed yet · Published 23 Jan 2025 · Tags: CWE-204, CWE-208 - [Cosmos userbase checking vulnerability](https://agentprime.io/advisories/CVE-2025-23214.md) `CVE-2025-23214` · CVE record: azukaar Cosmos-Server · CVSS 6.9 Medium · Not analysed yet · Published 20 Jan 2025 · Tags: CWE-204 - [Fortinet FortiClientEMS: An observable response discrepancy vulnerability \[CWE-204\] in FortiClientEMS 7.4.0…](https://agentprime.io/advisories/CVE-2024-36510.md) `CVE-2024-36510` · CVE record: Fortinet FortiClientEMS and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-204 - [HCL MyXalytics is affected by username enumeration vulnerability](https://agentprime.io/advisories/CVE-2024-42174.md) `CVE-2024-42174` · CVE record: HCL Software DRYiCE MyXalytics · CVSS 3.7 Low · Not analysed yet · Published 11 Jan 2025 · Tags: CWE-204 - [langhsu Mblog Blog System login observable response discrepancy](https://agentprime.io/advisories/CVE-2024-13198.md) `CVE-2024-13198` · CVE record: langhsu Mblog Blog System · CVSS 6.3 Medium · Not analysed yet · Published 9 Jan 2025 · Tags: Information disclosure, CWE-204 - [Antabot White-Jotter login observable response discrepancy](https://agentprime.io/advisories/CVE-2024-13028.md) `CVE-2024-13028` · CVE record: Antabot White-Jotter · CVSS 6.3 Medium · Not analysed yet · Published 29 Dec 2024 · Tags: Information disclosure, CWE-204 - [funnyzpc Mee-Admin Login login observable response discrepancy](https://agentprime.io/advisories/CVE-2024-12663.md) `CVE-2024-12663` · CVE record: funnyzpc Mee-Admin · CVSS 6.3 Medium · Not analysed yet · Published 16 Dec 2024 · Tags: Information disclosure, CWE-204 - [Cisco Enterprise Chat and Email Username Enumeration Vulnerability](https://agentprime.io/advisories/CVE-2022-20633.md) `CVE-2022-20633` · CVE record: Cisco Cisco Enterprise Chat and Email · CVSS 5.3 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: CWE-204 - [Django allows enumeration of user e-mail addresses](https://agentprime.io/advisories/GHSA-rrqc-c2jx-6jgv.md) `GHSA-rrqc-c2jx-6jgv`, `BIT-django-2024-45231`, `CVE-2024-45231`, `PYSEC-2026-1297` · PyPI `django`: affected `<4.2.16 || >=5.0, <5.0.9 || >=5.1, <5.1.1`, fixed in `4.2.16`, `5.0.9`, `5.1.1` · CVSS 3.7 Low · Not analysed yet · Published 8 Oct 2024 · Tags: Information disclosure, CWE-204 - [goTenna Pro ATAK Plugin Observable Response Discrepancy](https://agentprime.io/advisories/CVE-2024-41715.md) `CVE-2024-41715` · CVE record: goTenna Pro ATAK Plugin · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2024 · Tags: CWE-204 - [Observable Response Discrepancy in goTenna Pro](https://agentprime.io/advisories/CVE-2024-47129.md) `CVE-2024-47129` · CVE record: goTenna Pro · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2024 · Tags: CWE-204 - [Netcat CMS: user enumeration](https://agentprime.io/advisories/CVE-2024-8651.md) `CVE-2024-8651` · CVE record: NetCat NetCat CMS · CVSS 6.9 Medium · Not analysed yet · Published 19 Sept 2024 · Tags: CWE-204 - [Mautic allows users enumeration due to weak password login](https://agentprime.io/advisories/GHSA-8vff-35qm-qjvv.md) `GHSA-8vff-35qm-qjvv`, `CVE-2024-47059`, `PKSA-vtdm-dnf3-m5wp` · Packagist `mautic/core`: affected `>=5.1.0, <5.1.1`, fixed in `5.1.1` · CVSS 4.3 Medium · Not analysed yet · Published 18 Sept 2024 · Tags: Information disclosure, CWE-204 - [User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the server responses of the forgot password func…](https://agentprime.io/advisories/CVE-2024-34336.md) `CVE-2024-34336` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2024 · Tags: CWE-204 - [Siemens Mendix Runtime V10: A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.17.0 only…](https://agentprime.io/advisories/CVE-2023-49069.md) `CVE-2023-49069` · CVE record: Siemens Mendix Runtime V10 and 4 more · CVSS 6.9 Medium · Not analysed yet · Published 10 Sept 2024 · Tags: CWE-204 - [Loway - CWE-204: Observable Response Discrepancy](https://agentprime.io/advisories/CVE-2024-42343.md) `CVE-2024-42343` · CVE record: Loway QueueMetrics · CVSS 5.3 Medium · Not analysed yet · Published 8 Sept 2024 · Tags: CWE-204 - [Answer has Observable Response Discrepancy in github.com/answerdev/answer](https://agentprime.io/advisories/GHSA-6x5v-cxpp-pc5x.md) `GHSA-6x5v-cxpp-pc5x`, `CVE-2023-1540`, `GO-2023-1654` · Go `github.com/answerdev/answer`: affected `<1.0.6`, fixed in `1.0.6` · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: CWE-204 - [Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy](https://agentprime.io/advisories/CVE-2024-38431.md) `CVE-2024-38431` · CVE record: Matrix Tafnit v8 · CVSS 5.3 Medium · Not analysed yet · Published 30 Jul 2024 · Tags: CWE-204 - [OpaMiddleware does not filter HTTP OPTIONS requests](https://agentprime.io/advisories/GHSA-5f5c-8rvc-j8wf.md) `GHSA-5f5c-8rvc-j8wf`, `CVE-2024-40627`, `PYSEC-2026-1361` · PyPI `fastapi-opa`: affected `<2.0.1`, fixed in `2.0.1` · CVSS 5.8 Medium · Not analysed yet · Published 15 Jul 2024 · Tags: CWE-204 - [The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames](https://agentprime.io/advisories/GHSA-875x-g8p7-5w27.md) `GHSA-875x-g8p7-5w27`, `CVE-2024-39912`, `PKSA-3mms-4n3p-ym65`, `PKSA-sjrk-y37x-n2ck` · Packagist `web-auth/webauthn-framework` and 1 more: affected `>=4.5.0, <4.9.0`, fixed in `4.9.0` · CVSS 5.3 Medium · Not analysed yet · Published 15 Jul 2024 · Tags: CWE-204 - [IBM Security ReaQta information disclosure](https://agentprime.io/advisories/CVE-2023-33859.md) `CVE-2023-33859` · CVE record: IBM Security QRadar EDR · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2024 · Tags: CWE-204 - [Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_email field only if the user account exists.](https://agentprime.io/advisories/CVE-2024-39211.md) `CVE-2024-39211` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 4 Jul 2024 · Tags: CWE-204 - [Information Disclosure of user names](https://agentprime.io/advisories/CVE-2024-36996.md) `CVE-2024-36996` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: CWE-204 - [IBM Storage Defender information disclosure](https://agentprime.io/advisories/CVE-2024-38322.md) `CVE-2024-38322` · CVE record: IBM Storage Defender - Resiliency Service · CVSS 5.3 Medium · Not analysed yet · Published 28 Jun 2024 · Tags: CWE-204 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .